# Gobuster & Directory Enumeration

> Stop just looking at the homepage. Master the art of directory enumeration to uncover hidden admin panels, backup files, and forgotten web paths using Gobuster and SecLists.

Canonical: https://codelivly.com/rooms/gobuster-directory-enumeration
Last updated: 2026-07-07

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 6 |
| Estimated time | 30 min |
| XP | 200 |

When an attacker finds a web server, amateurs just browse the homepage and call it a day. Professionals know that the homepage is just the lobby. The real secrets—admin panels, database backups, developer notes, and misconfigured APIs are hidden deep inside the directory structure.

In this beginner-friendly module, we transition from network-level reconnaissance to web application mapping. You will learn how web directories work, why developers accidentally leave sensitive files exposed, and how to use Gobuster, the industry-standard tool for directory brute-forcing. We will master the crucial HTTP status codes that tell you when you've found a hidden gem, and we will learn how to leverage the SecLists project to feed Gobuster the exact wordlists it needs to map the entire web application. Stop guessing URLs. Start enumerating them.

## Lessons

1. What is Directory Brute Forcing (30 min)
2. Gobuster Installation & Basic Usage (30 min)
3. Wordlists 101 (30 min)
4. File Extension Fuzzing & Hidden Endpoints (30 min)
5. Ffuf - A Faster Alternative Fuzzer (30 min)
6. Guided Lab: Uncovering a Hidden Admin Panel (30 min)

## Related

- [Learning path: Recon & Enumeration Tools](https://codelivly.com/learning-paths/recon-enumeration-tools)
- [All rooms](https://codelivly.com/rooms)